9.8Kritik
KEV
CVE-2020-15069Sophos XG Firewall Buffer Overflow Vulnerability
Aktif olarak istismar ediliyor — Sophos XG Firewall Buffer Overflow Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 06.02.2025 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 27.02.2025.
Gerekli işlem: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal ; https://nvd.nist.gov/vuln/detail/CVE-2020-15069
Açıklama
Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.
Zayıflık türü (CWE):
CWE-120
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| sophos | xg firewall firmware | 17.0 – < 17.5 |
Kaynaklar ve yamalar
- https://community.sophos.com/b/security-blog/posts/advisory-buffer-overflow-vulnerability-in-user-portal MitigationVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15069 US Government Resource
CPE eşleşmeleri (NVD) (13)
cpe:2.3:o:sophos:xg_firewall_firmware:*:*:*:*:*:*:*:*≥ 17.0 < 17.5cpe:2.3:o:sophos:xg_firewall_firmware:17.5:-:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release1:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release10:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release11:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release12:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release3:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release4:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release5:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release6:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release7:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release8:*:*:*:*:*:*cpe:2.3:o:sophos:xg_firewall_firmware:17.5:maintenance_release9:*:*:*:*:*:*